4.9

CVE-2025-30086: harbor Go

Deferred
AliasesGHSA-h27m-3qw8-3pw8GO-2025-3826
Published 25-07-2025Last modified 25-07-2025

Vulnerability summary

CVE-2025-30086 is a medium (CVSS 4.9) vulnerability in harbor Go. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 4.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.71%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2025:15405-1

Timeline

  1. 25-07-2025
    PublishedVulnerability first disclosed.
  2. 25-07-2025
    Last modifiedVulnerability information updated.

Description

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

Increase +0.09 pp

From 0.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Github.com/goharbor1 product
  • harbor≥ 2.13.0, < 2.13.1 | ≥ 2.4.0-rc1.1, < 2.12.4 | < 2.4.0-rc1.0.20250331071157-dce7d9f5cffb | ≥ 2.13.0+incompatible, < 2.13.1+incompatible

1 vendor · 1 product

References

9 links